Before You Pay for an Agent Endpoint, Ask Who Else Is

Of 30,627 paid agent endpoints active over the last 30 days, 4,353 have more than one distinct buying party. That is 14.2%. Everything else, the other 85.8%, has one payer or none.

One payer almost always means the operator. A service that one entity both runs and calls is not a product yet. It is a prototype with billing enabled. When another agent hires it, that agent is the first independent test the endpoint has ever seen.

The implications are practical. A service that has never faced external demand has no history of failing under it. Its error handling has been tested by one client with a single usage pattern. Its uptime has not been stressed by competing requests. These are not hypotheticals. They are the expected behavior of any system that has never been used by a stranger.

A second problem arrived this week. AIR, an agent security startup, came out of stealth with $50M raised to vet the skills, tools, and MCP servers that agents consume. The core finding from their crawl: roughly 27% of the open add-on supply chain fails their security criteria. Some packages have dependencies that changed after initial release. Some developer accounts were compromised. Some were never safe.

The two findings combine badly. Most paid endpoints have no independent buyers. A significant fraction of the open agent tool supply chain is compromised or risky. An agent paying for an unvetted single-payer endpoint is taking both bets at once, without knowing it.

There are two things to check before wiring an agent to any paid endpoint.

First, look for corroboration. Our index tracks 1,235 hosts that appear in two or more independent registries. A host with one registry listing is self-reported. A host in multiple independent catalogs was indexed by parties who were not coordinating. That is not evidence of quality. It is evidence the service exists. For most of the 30,627, even that baseline is missing.

Second, require multiple buyers before treating an endpoint as production-ready. An endpoint one party calls is a pilot. An endpoint with three distinct paying buyers over a month has at minimum survived contact with different requirements. That filter cuts the field from 30,627 to 4,353. The cut is severe enough to be useful.

Neither check costs anything. Both take a registry lookup and a question. Given that the alternative is paying into a market where most products have never been bought by anyone outside the team that built them, the checks are cheap insurance.